ZoneMinder 1.29.0
Approved changes feed: RSS · Atom
cpe:2.3:a:zoneminder:zoneminder:1.29.0:*:*:*:*:*:*:*part: a version: 1.29.0 update: *
| Vendor | Zoneminder (e6e02621-7fd3-519d-9da5-7d751a0c0507) |
|---|---|
| Product | Zoneminder (bce2b260-429d-537f-a893-eaa0ebd37c1c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/zoneminder |
purl2cpe | 2026-06-01 10:11:26.776065 |
pkg:deb/ubuntu/zoneminder |
purl2cpe | 2026-06-01 10:11:26.776066 |
pkg:github/zoneminder/zoneminder |
purl2cpe | 2026-06-01 10:11:26.776068 |
pkg:rpm/opensuse/zoneminder |
purl2cpe | 2026-06-01 10:11:26.776069 |
pkg:sourceforge/zoneminder |
purl2cpe | 2026-06-01 10:11:26.776070 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-5368 |
vulnerable | 2026-06-08 05:09:46.797221 |
Details available
ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and automatically create a new admin user within the web application for remote persistence and further attacks. The URL is /zm/index.php and sample parameters could include action=user uid=0 newUser[Username]=attacker1 newUser[Password]=Password1234 conf_password=Password1234 newUser[System]=Edit (among others).
Published: 2017-02-06T17:00:00.000Z
Updated: 2024-08-05T14:55:35.799Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5367 |
vulnerable | 2026-06-08 05:09:46.795880 |
Details available
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).
Published: 2017-02-06T17:00:00.000Z
Updated: 2024-08-05T14:55:35.811Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.